Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/629b322..ab0bc70

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/bffe083..d637de7

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2675183002
Cr-Commit-Position: refs/heads/master@{#42945}

Add a simple microbenchmark for calling copyWithin on a moderately large
Float64Array with 10,000 elements.

BUG=v8:5925, v8:5929, v8:4648
R=cbruni@chromium.org, adamk@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2676193002
Cr-Commit-Position: refs/heads/master@{#42944}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/5e0a1c8..bffe083

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2671183002
Cr-Commit-Position: refs/heads/master@{#42943}

Revert of [debugger] remove debugger statement support from FCG/CS. (patchset #5 id:80001 of https://codereview.chromium.org/2650193002/ )

Reason for revert:
Fails on chromium leak bot:
https://uberchromegw.corp.google.com/i/chromium.webkit/builders/WebKit%20Linux%20Trusty%20Leak/builds/2007

Original issue's description:
> [debugger] remove debugger statement support from FCG/CS.
>
>
> R=mstarzinger@chromium.org
>
> Review-Url: https://codereview.chromium.org/2650193002
> Cr-Commit-Position: refs/heads/master@{#42892}
> Committed: https://chromium.googlesource.com/v8/v8/+/eef855a1dc956e9db03ec09abca1d732d379861b

TBR=mstarzinger@chromium.org,yangguo@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/2672823007
Cr-Commit-Position: refs/heads/master@{#42942}

The property details of a LookupIterator are not accessible,
if the iterator state is interceptor. Instead, use the
property attributes.

Fixes a crash in Node.js tests in Debug mode, see
https://github.com/nodejs/node/commit/c2c6ae52eaf302da9c106699b69d17c083ced316

BUG=

Review-Url: https://codereview.chromium.org/2675993002
Cr-Commit-Position: refs/heads/master@{#42941}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d4321a9..629b322

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/53604dd..5e0a1c8

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/88069f4..426ef62

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2677613006
Cr-Commit-Position: refs/heads/master@{#42940}

Blink uses access checks to be sure that objects from one context doesn't access objects in another. Heap profiler uses current context to call this checks, we need to be sure that current context is empty to allow heap profiler collect all objects without crash.

BUG=chromium:661223
R=alph@chromium.org,ulan@chromium.org

Review-Url: https://codereview.chromium.org/2669393002
Cr-Commit-Position: refs/heads/master@{#42939}

BUG=687196
R=jbroman@chromium.org

Review-Url: https://codereview.chromium.org/2674613002
Cr-Commit-Position: refs/heads/master@{#42938}

BUG=686338
R=cbruni@chromium.org,jbroman@chromium.org

Review-Url: https://codereview.chromium.org/2662193002
Cr-Commit-Position: refs/heads/master@{#42937}

This is needed to insulate generated code from blink::protocol namespace
from naming changes that we plan to do in the Great Blink Rename (which
in particular will rename wtf::StringBuilder::find method into Find).

This CL also includes roll of inspector_protocol which starts to
generate code that uses the new StringUtil::find adapter method:
rolling third_party/inspector to 1a7cbe8ba8fa0d622586f549a97c73d9b52efbea

BUG=683447

Review-Url: https://codereview.chromium.org/2675763003
Cr-Commit-Position: refs/heads/master@{#42936}

BUG=v8:1569
R=dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2669713002
Cr-Commit-Position: refs/heads/master@{#42935}

The JumpIfFalse and JumpIfTrue bytecodes test the accumulator, and
branch based on whether the accumulator is true or false (no other
value allowed, and in fact TurboFan would blow up if you would pass
anything else, since Branch operator can only deal with Boolean).
So for either branch we know exactly the value of the accumulator,
and we can update the environment to this constant value instead.

This helps to avoid the useless bit materialization that currently
happens when || or && is being used in a value context.

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win64_dbg
R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2666283002
Cr-Original-Commit-Position: refs/heads/master@{#42843}
Committed: https://chromium.googlesource.com/v8/v8/+/158ac9287193f315342ad31c38fe451620d176eb
Review-Url: https://codereview.chromium.org/2666283002
Cr-Commit-Position: refs/heads/master@{#42934}

BUG=

R=jyan@ca.ibm.com, joransiu@ca.ibm.com, bjaideep@ca.ibm.com

Review-Url: https://codereview.chromium.org/2667353005
Cr-Commit-Position: refs/heads/master@{#42933}

With the old logic, a suppression shows up in the statistics independent if the test cases caused a difference or not. This doesn't give a signal if a suppression is useful. The new logic will help cleaning up suppressions that never apply.

BUG=chromium:673246
NOTRY=true
R=tandrii@chromium.org
TBR=mstarzinger@chromium.org,jarin@chromium.org

Change-Id: Iaebdac475f408f7d2649a34ccaa580c8d91e34a5
Reviewed-on: https://chromium-review.googlesource.com/437264Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42932}

BUG=chromium:673246,chromium:688307
NOTRY=true
R=tandrii@chromium.org
TBR=mstarzinger@chromium.org

Change-Id: I269032497cf574cf5180762e37b0fee1002a6c76
Reviewed-on: https://chromium-review.googlesource.com/437244Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42931}

BUG=chromium:673246
NOTRY=true
TBR=mstarzinger,jarin

Review-Url: https://codereview.chromium.org/2669263005
Cr-Commit-Position: refs/heads/master@{#42930}

BUG=v8:5922

Review-Url: https://codereview.chromium.org/2669223002
Cr-Commit-Position: refs/heads/master@{#42929}

We cannot optimize global proxy access unless deoptimization is enabled.

BUG=chromium:687990
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2675793002
Cr-Commit-Position: refs/heads/master@{#42928}

Revert of Removes uint8_t from MachineRepresentation and MachineSemantic enums. (patchset #1 id:1 of https://codereview.chromium.org/2669113003/ )

Reason for revert:
Breaks bunch Wasm tests on Win64 (e.g., cctest/test-run-wasm/RunWasmCompiled_CallIndirect_EmptyTable).

Original issue's description:
> Removes uint8_t from MachineRepresentation and MachineSemantic enums.
>
> This works around a compiler bug that leads to incorrect masking of
> the semantic_ field in TruncatingUseInfoFromRepresentation.
>
> Patch from bulach@google.com
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2669113003
> Cr-Commit-Position: refs/heads/master@{#42925}
> Committed: https://chromium.googlesource.com/v8/v8/+/8c7fc377fd5c03e30cbf767cd22aba59178e0143

TBR=bulach@google.com,bmeurer@chromium.org,ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2669213006
Cr-Commit-Position: refs/heads/master@{#42927}

BUG=v8:5269, v8:1956
LOG=N
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2663033003
Cr-Commit-Position: refs/heads/master@{#42926}

This works around a compiler bug that leads to incorrect masking of
the semantic_ field in TruncatingUseInfoFromRepresentation.

Patch from bulach@google.com

BUG=

Review-Url: https://codereview.chromium.org/2669113003
Cr-Commit-Position: refs/heads/master@{#42925}

Before this change, we attributed samples for the top-most interpreter frame to the second-topmost frame if we were in a bytecode handler with elided frame. With this change we try to detect that we are in a handler without a frame. If we are, we do not drop the topmost frame.

For example, consider the program

function inner() {
  var s = 0;
  for (var i = 0; i < 100000; i++) {
    s += i * i;
  }
  return s;
}

function trivial() {
  return inner();
}

for (var i = 0; i < 2000; i++) {
  trivial();
}

Before this change, d8 --prof --ignition --nocrankshaft and linux-tick-processor would produce:

  [JavaScript]:
   ticks  total  nonlib   name
   4885   83.4%   83.5%  Function: ~trivial a.js:15:17
    759   13.0%   13.0%  Function: ~inner a.js:7:15

After this change, we get

 [JavaScript]:
   ticks  total  nonlib   name
   5486   95.9%   96.2%  Function: ~inner a.js:7:15
      4    0.1%    0.1%  Function: ~trivial a.js:15:17

Review-Url: https://codereview.chromium.org/2667253004
Cr-Original-Commit-Position: refs/heads/master@{#42894}
Committed: https://chromium.googlesource.com/v8/v8/+/d07f6540c1f9628ed2ba1fa6507c90db07ccc5f5
Review-Url: https://codereview.chromium.org/2667253004
Cr-Commit-Position: refs/heads/master@{#42924}

The StringIndexOf stub does the same thing but better (it uses memchr
instead of a manual loop).

Review-Url: https://codereview.chromium.org/2667963002
Cr-Commit-Position: refs/heads/master@{#42923}

R=jgruber@chromium.org
BUG=v8:5902

Review-Url: https://codereview.chromium.org/2669423002
Cr-Commit-Position: refs/heads/master@{#42922}

Review-Url: https://codereview.chromium.org/2670183004
Cr-Commit-Position: refs/heads/master@{#42921}

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2669753002
Cr-Commit-Position: refs/heads/master@{#42920}

This adds helper stubs for RegExp split and replace operations, called directly
by both RegExpPrototype{Replace,Split} and StringPrototype{Replace,Split}.

BUG=

Review-Url: https://codereview.chromium.org/2668703002
Cr-Commit-Position: refs/heads/master@{#42919}

This runs the existing checkpoint elimination during the "inlining"
optimization phase. It will eliminate redundant checkpoint nodes and
hence reduce graph size earlier. After this change the reducer in
question runs during {InliningPhase} as well as {TypedLoweringPhase}.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2670763003
Cr-Commit-Position: refs/heads/master@{#42918}

Apparently it happens quite easily that different NaNs are produced in
the interpreter than in the execution of the compiled code. This
non-determinism caused problems for the fuzzer which compares the
equality of the results of the interpreter and the compiled code.

I decided therefore to refactor the detection of non-determinism in the
interpreter. Instead of tracking whether potentially non-deterministic
NaNs were produced, I track now whether potentially non-deterministic
NaNs could have been observed. The only way the NaN non-determinism can
be observed is by observing the non-deterministic bit pattern of the
NaN. AFAICT the only way to observe the bit pattern is with a
I(32|64)_REINTERPRET_F(32|64) instruction or with a F(32|64)_STORE
followed by a load. Therefore I flag an execution as potentially
non-deterministic when either a NaN is reinterpreted to an int, or when
a NaN is stored to memory.

R=titzer@chromium.org, eholk@chromium.org
BUG=682180

Review-Url: https://codereview.chromium.org/2671803002
Cr-Commit-Position: refs/heads/master@{#42917}

R=jarin@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2664423003
Cr-Commit-Position: refs/heads/master@{#42916}

The wasm module we generate for the test case actually has an initial
memory size of 16. In the mjsunit test we generate, however, we set the
initial memory size to 32. This CL changes the initial memory size in
the mjsunit test now to 16.

R=eholk@chromium.org

Change-Id: I5d3a30a97c3b0ba3105a8cf17d4c088a8fb9c8b7
Reviewed-on: https://chromium-review.googlesource.com/436544
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42915}

By now the effect-control linearizer correctly determines the dominating
checkpoint, even for cases that contain effect-flow. We can elide the
temporary checkpoints during lowering of property loads and stores that
involve a sequence of map-checks.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2677483002
Cr-Commit-Position: refs/heads/master@{#42914}

BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2670633003
Cr-Commit-Position: refs/heads/master@{#42913}

Revert of [profiler] Fix attribution for the top-most interpreted frame. (patchset #3 id:40001 of https://codereview.chromium.org/2667253004/ )

Reason for revert:
Flaky crashes on mac asan:
https://build.chromium.org/p/client.v8/builders/V8%20Mac64%20ASAN/builds/10739

Original issue's description:
> [profiler] Fix attribution for the top-most interpreted frame.
>
> Before this change, we attributed samples for the top-most interpreter frame to the second-topmost frame if we were in a bytecode handler with elided frame. With this change we try to detect that we are in a handler without a frame. If we are, we do not drop the topmost frame.
>
> For example, consider the program
>
> function inner() {
>   var s = 0;
>   for (var i = 0; i < 100000; i++) {
>     s += i * i;
>   }
>   return s;
> }
>
> function trivial() {
>   return inner();
> }
>
> for (var i = 0; i < 2000; i++) {
>   trivial();
> }
>
>
> Before this change, d8 --prof --ignition --nocrankshaft and linux-tick-processor would produce:
>
>   [JavaScript]:
>    ticks  total  nonlib   name
>    4885   83.4%   83.5%  Function: ~trivial a.js:15:17
>     759   13.0%   13.0%  Function: ~inner a.js:7:15
>
> After this change, we get
>
>  [JavaScript]:
>    ticks  total  nonlib   name
>    5486   95.9%   96.2%  Function: ~inner a.js:7:15
>       4    0.1%    0.1%  Function: ~trivial a.js:15:17
>
> Review-Url: https://codereview.chromium.org/2667253004
> Cr-Commit-Position: refs/heads/master@{#42894}
> Committed: https://chromium.googlesource.com/v8/v8/+/d07f6540c1f9628ed2ba1fa6507c90db07ccc5f5

TBR=bmeurer@chromium.org,jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2670843005
Cr-Commit-Position: refs/heads/master@{#42912}

Simulator trace will display content of target floating point registers.
Content of FP registers is displayed in hexadecimal form which is
followed with float or/and double interpretation.
Also, with this implementation will be displayed contents of general
purpose registers (GPRs). Hexadecimal form is followed with signed
and unsigned integer interpretation (32-bit or/and 64-bit).

TEST=
BUG=

Review-Url: https://codereview.chromium.org/2603083002
Cr-Commit-Position: refs/heads/master@{#42911}

This flag is true when compiled script is ES6 module.

BUG=v8:1569
R=dgozman@chromium.org,adamk@chromium.org

Review-Url: https://codereview.chromium.org/2663973002
Cr-Commit-Position: refs/heads/master@{#42910}

Turns out is_hidden is not the right condition for "scope should be present in
the preparse data". For now, replaced it with "is hidden leaf scope" (i.e.,
doesn't contain any non-hidden scopes). That's probably not the right condition
either; will be fixed once there's more data to decide what the right condition
is.

BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2669163002
Cr-Commit-Position: refs/heads/master@{#42909}

The extras utils object will no longer be needed after
bootstrapping, and can be cleared.

R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2670093002
Cr-Commit-Position: refs/heads/master@{#42908}

V8DebuggerAgentImpl::m_skipAllPaused is moved to V8Debugger.
V8DebuggerAgentImpl::didPaused doesn't return shouldBreak flag and called only when break is required and stack trace presented.
V8DebuggerAgentImpl doesn't store paused context.
Logic of conversion step-next at return into step-in is moved to debug.cc.

BUG=none
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2668763003
Cr-Commit-Position: refs/heads/master@{#42907}

BUG=

Review-Url: https://codereview.chromium.org/2640783007
Cr-Commit-Position: refs/heads/master@{#42906}